Privacy policy

Version 1.0 · Effective 29 October 2026 · Last reviewed 29 October 2026

This policy covers the Frontline999 platform, including the limited subset of features offered and used by this temporary landing page.

1. Who we are

Frontline999 is a trading name of BlackIce Trading Ltd, a company registered in England and Wales under company number 08735675, with its registered office at Apex House, Thomas Street, Trethomas, Caerphilly, CF83 8DP. We are registered with the Information Commission under registration number ZA061200.

In this policy, “we”, “us” and “our” mean BlackIce Trading Ltd. We are the controller of the personal data described here. That means we decide how and why it is used, and we are responsible for it under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).

We sell products from our own range and from creator brands (“vendors”) on the Frontline999 marketplace, to the public and to businesses. We are the seller on every order. We take the payment, deal with delivery and returns, and handle all customer support. Vendors do not receive your name, email, phone number or address.

Email: contact at frontline999 dot co dot uk

The best way to reach us about anything in this policy, including requests to use your rights, is to email us at the address above.

We have not appointed a Data Protection Officer. The law requires one only for public authorities and for organisations whose core activities involve large-scale monitoring of people or large-scale processing of sensitive data, and ours don't. Please send any privacy questions using the contact details above.

2. Who this covers

This policy applies to anyone whose personal data we handle through Frontline999:

• visitors to our websites, including our shop, our business site and our vendor and supplier portal, and the pages our emails link to;
• customers, whether you check out as a guest or with an account;
• people who receive a parcel that someone else ordered for them, such as a gift, or an order a business placed for one of its own customers;
• people who join our mailing lists or contact us;
• staff of businesses and organisations with a business account, and people who apply for one;
• vendors, their team members, and our suppliers' contacts, as far as their personal data is concerned.

Our own staff are covered by a separate staff privacy notice.

3. What we collect and why

The table below sets out what we collect, what we use it for, and the lawful basis we rely on under Article 6 of the UK GDPR. Most of it comes from you directly. Some is generated when you use our sites, and a small amount comes from third parties (for example, delivery updates from carriers, or a delivery name and address given to us by someone sending you a parcel).

Recognised legitimate interests are set out in law. They cover, for example, disclosures needed to prevent or detect crime, to respond to an emergency or to safeguard a vulnerable person.

Our legitimate interests

Where we rely on legitimate interests, those interests are running a secure, reliable shop, preventing fraud and abuse, fixing faults, dealing with enquiries and applications, delivering parcels to the people they are meant for, keeping in touch with the businesses we work with, and respecting your marketing choices. We have balanced them against your rights and recorded that assessment. We don't use this basis for anything you wouldn't reasonably expect. You can object at any time (see section 11).

If you received a parcel from us

If someone ordered something for you, they gave us your name and delivery address. We use them only to deliver that order, keep them as part of the buyer's order record (section 8), and never use them for marketing. If the buyer gave us your email address, it is passed only to the courier for delivery updates. We never email you ourselves. A gift message the buyer wrote goes in the parcel and is kept only as part of the order record.

If a business ordered for you, for example a supplier sending you goods you bought from them, that business is responsible for telling you it shares your details with us for delivery. We act only on the delivery instructions it gives us.

Adding a guest order to your account

If you placed an order as a guest, you can add it to your account. We email a link to the address on the order, and the order is added only when that link is used.

If you don't give us data

We need your name, email, delivery address and payment to complete an order. Without them we can't sell to you. Marketing is optional, and you can turn analytics off at any time.

Health and other sensitive information

We don't ask for health, ethnicity, religious or other special category data. Please don't include it in messages or return photos. If it reaches us anyway, only the person dealing with your request sees it. We use it only if you confirm you want us to take it into account (for example, a health reason for a late return), or if it's needed for a dispute, and we delete it when your request is closed.

4. Cookies, analytics and your choices

The same choices apply on our shop, our business site and our vendor and supplier portal. Our cookie banner offers Allow all, Reject all and More options, where you can set each option yourself. Declining is as easy as accepting, and you can change your choices at any time with Privacy settings in the footer.

Anonymous analytics is on by default because we use it only for internal, aggregated figures that show us how the sites are used and what people are interested in. It sets no cookie and identifies nobody. When you turn it off, your browser doesn't contact our analytics at all. If your browser sends Do Not Track or Global Privacy Control, we keep all analytics off, even if you choose Allow all. Nothing here is used for advertising, and we don't track you across other websites.

Cookies we use

If you start changing your email address, we keep it in your browser's session storage until you close the tab. Guest order cookies contain no personal details and can't be read by scripts on the page; if you delete them, use the link in your order email or “Find your order”. You can block cookies in your browser, but sign-in, the basket and checkout won't work without the necessary ones. To forget your personalisation settings, use Reset preferences in the footer.

How our analytics works

We run our analytics ourselves, on our own servers in London, and share the data with nobody except our hosting provider. It uses your IP address only to work out your approximate country, and doesn't keep it. It records the pages you view, without anything after the “?” in the address apart from our campaign names, with order and record numbers masked, and nothing at all for pages whose address contains a private link. It also records a few shop actions: basket changes, checkout steps and the kind of error that stops one (never card details), completed orders (value and currency only), filters and sorting, discount codes we accepted, searches (with anything that looks like an email or IP address removed) and mailing-list signups (that someone joined, not who). We never record what you bought, your name or your address. We delete detailed records after 2 years and keep only totals.

Error reports

Anonymous error reports are how we find out something is broken, so they are always on. They don't include your account, email address, IP address, cookies or anything you typed. If you allow error reports with your account, your account ID is added to reports from your browser while you are signed in. Our error-reporting provider stores reports in the EU.

Affiliate discounts

If an affiliate gives you a discount code, enter it at checkout. We credit the affiliate whose code you use. We don't use cookies, links or anything else on your device to track which affiliate sent you.

5. Marketing emails

We only send marketing emails to people who have asked for them. You can join a list through a signup form, in your account, or by ticking the box at checkout on the shop. The business site doesn't collect marketing consent.

• Confirming. Most lists ask you to confirm by clicking a link we email you. We don't keep your address until you confirm, and the link expires after 7 days. We then record when you agreed, which list and wording you agreed to, and when and from which IP address you confirmed. A few lists add you straight away and send a welcome email instead.
• Private lists. Some lists aren't advertised on our sites. You can join them only through a signup link we share (for example on social media), or by invitation. We only invite people who have already agreed to hear from us in another way, for example in person, or on a mailing list we have moved across from our previous email system. The invitation asks you to confirm, and you are added only if you use its link.
• Which lists you see. Some lists are sent under the name of one of our sites or brands. Whatever name an email shows, we send it and we're responsible for your data. Your account on each of our sites shows that site's lists and any other list you're on, and you can join or leave them there.
• Unsubscribing. Every marketing email has an unsubscribe link, and your email app's own unsubscribe button works too. Either removes you from the list that sent the email straight away. The unsubscribe page also lets you leave your other lists, or all of them.
• What we keep after you leave. When you leave your last list, we delete your email address. We keep an anonymous record of when you joined and left, and how, so our list figures still add up. It can't be linked back to you. We also add your address to a do-not-email record (a suppression list), which we use only to make sure you aren't added back by mistake, for example from an imported list or an email already queued. If you sign up again later, it is removed and you start afresh.
• If emails bounce or you report spam. If our email provider tells us your address no longer works, or that you marked our email as spam, we remove you from our lists in the same way and add your address to the do-not-email record.
• Clicks. Links in our marketing emails pass through our own link service, which counts the click against the campaign and the page it leads to before sending you on. It doesn't record who you are or your IP address, and every recipient of a campaign gets the same links. Links to our own sites also carry the campaign's name, so our analytics can see which campaign a visit came from, if analytics is on.
• Opens. We don't track whether you open our emails. Our email provider's open and click tracking is switched off.
• Sharing. We don't sell or share our mailing lists. Our email provider receives your address only to send our emails to you.

Order confirmations, delivery updates, payment reminders, sign-in links, security alerts and replies to your requests are service emails, not marketing. You'll receive them whatever your marketing choice.

6. Who we share data with

We never sell your personal data. We share it only as described below.

Service providers (processors)

These companies process personal data for us, only on our instructions and under a written data processing agreement.

Our analytics, mailing-list and e-signing systems run on our own servers, and we share that data with nobody other than the hosting providers above.

Other organisations

• Stripe as an independent controller. Stripe also uses payment data for its own purposes. These include fraud prevention, meeting its financial-services obligations (including identity checks on vendors who receive payouts), and running Stripe Link if you choose to use it. Stripe Link is Stripe's saved-details checkout, run by Stripe as part of payments. It only creates a Link account if you choose to enter a phone number at checkout. For that use, Stripe's privacy policy applies. Stripe decides which payment methods you're offered at checkout (card, Link, Apple Pay, Google Pay or Klarna), based on things like your device and account.
• Klarna, if you choose to pay with Klarna. Klarna runs its own identity and credit checks and is responsible for that data under Klarna's privacy notice.
• Apple and Google, if you pay with Apple Pay or Google Pay. Your wallet details are handled by Apple or Google under their own privacy policies. We receive only the payment result.
• Our production and fulfilment partners. These are our own warehouse and a garment and print production business in South Wales that makes, holds stock for and dispatches orders for us, under a written processing agreement. They receive the recipient's name, delivery address, phone number, email address, any gift message, and the items ordered, and use them only to make and send the order. We send them order files over an encrypted connection to their own server.
• Royal Mail Group Limited, our delivery carrier. It receives the recipient's name and delivery address and, where needed for delivery updates, an email address or phone number. Royal Mail is responsible for that data as an independent controller under its own privacy notice.
• HM Revenue & Customs, for tax reporting as the law requires.
• Vendors and affiliates see only that a sale happened: vendors see the item, quantity, price, order date and dispatch status for their own products, and affiliates see the commission earned on sales made with their code. Neither ever sees the buyer's name, contact details or address.
• Our accountants, who prepare our accounts and tax returns from our order, invoice and payout records, and other professional advisers such as lawyers and insurers, where they need it.
• Police, courts and regulators, where the law requires it, or where disclosure is necessary to prevent or detect crime, to respond to an emergency or to safeguard a vulnerable person, and is lawful under UK data protection law. A director of BlackIce Trading decides every request, and we disclose only what is needed.
• A buyer of our business. If we sell or plan to sell all or part of the business, we may share personal data with a prospective buyer and its advisers under confidentiality terms. If the sale goes ahead, the buyer will become responsible for your data and must use it in line with this policy unless it tells you otherwise.

Where this policy describes a type of recipient rather than naming it, you can ask us who received your data, and we'll tell you.

7. International transfers

Our application, database and analytics are hosted in the UK, and file storage is restricted to the EU. The UK recognises the EU as providing adequate protection. Our websites run on Cloudflare's global network, and some providers are US companies, so personal data may be handled in, or accessed from, other countries including the United States. Each of those providers is certified to the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”), which the UK recognises as providing adequate protection. If we ever use a provider that isn't certified, we will put the UK's International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, in place first. Contact us if you'd like more detail about these safeguards.

8. How long we keep it

We keep personal data only as long as we need it for the purpose we collected it for, or as long as the law requires. Where a period below is our own choice rather than a legal requirement, we say so.

9. How we protect it

• Your connection to our sites is encrypted (HTTPS/TLS). So are the connections between our separate systems, such as from our websites to our application, and from our application to our database, file storage and service providers.
• Our databases, servers and file storage are encrypted at rest. We check sign-in links and codes against a one-way scrambled (hashed) copy. The copy inside the email we sent you, customer details on VAT invoices, and the login details for our suppliers' systems get an extra layer of encryption in our own application.
• Links in our marketing emails are digitally signed, so nobody can change where they lead or use them to unsubscribe someone else.
• Sign-in is passwordless, using passkeys or single-use email links. Your fingerprint or face never leaves your device. We only hold a passkey's public key.
• When a passkey is added to your account, we email you straight away, with a link to tell us if it wasn't you. Before sensitive changes to your account, we email you a verification code.
• Sign-in sessions are held on our servers, not in your browser. They expire after 7 days without use, and we can end them all at once if an account is at risk.
• Staff administration requires a passkey with user verification. Vendor access is limited to their own products and never includes customer details.
• We log when our staff access your personal data, and keep that log for 12 months.
• We never change your delivery details or tell anyone about your order on the strength of an email alone. We check with you first at the email address on your order or account.
• Uploaded files are virus-scanned, and images have location and camera data removed, before they're stored.
• Private files (for example return photos and documents) are kept in storage that isn't publicly reachable. We only share them through short-lived, signed links.

If a breach puts your rights at risk, we will tell the Information Commission as the law requires, and if it is likely to put you at high risk, we will tell you directly and promptly.

10. Automated decisions

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. Stripe runs automated fraud checks on payments, and a payment may occasionally be declined as a result. If that happens, contact us and a person will look at the problem with you. We can't overturn a decision made by Stripe or your bank, but we can help you find another way to pay.

If you choose to pay with Klarna, Klarna may decide automatically whether to offer you credit. That decision is Klarna's, not ours. Klarna's privacy notice explains how to ask for a person to review it.

11. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you and get a copy;
• have inaccurate data corrected;
• have your data erased, where we no longer have a reason to keep it;
• restrict how we use it while a concern is looked into;
• object to processing based on our legitimate interests. You can also object to direct marketing at any time, and we will always stop;
• data portability, meaning a copy of the data you gave us in a machine-readable format, where the lawful basis is consent or contract;
• withdraw consent at any time, for example by unsubscribing from marketing emails or changing your privacy settings. This doesn't affect anything done before you withdrew it.

Getting a copy of your data

You can ask for a copy of your data. Our staff prepare it for you. It includes your account details, saved addresses, orders, any VAT invoices and credit notes, returns (with photos while we still hold them), your mailing-list consent records and your sign-in history. We also search our support mailboxes and other records for personal data about you, and include it, removing other people's details where we need to. We send it to you by encrypted email, with an explanation of how we use your data.

Closing your account

When you close your account, any open orders and returns are completed first. We then delete:

• your account details (name, email and phone number);
• your saved addresses;
• your passkeys, sign-in links and email-change requests, and we sign you out everywhere;
• your sign-in security records;
• the analytics ID that linked your visits to your account, if you had allowed analytics linked to you. We remove it from our analytics records, so the visits that remain are anonymous counts that point to nobody;
• your mailing-list subscriptions for your account's email address, as if you had unsubscribed. If you joined a list with a different email address, for example one you typed in at checkout, that stays until you unsubscribe from it;
• any unfinished baskets.

We keep some records because the law or possible claims need them:

• your orders, with the delivery and billing addresses reduced to the postcode district under the 24-month rule in section 8;
• any VAT invoices and credit notes, for 6 years from the end of the financial year;
• payment and refund records, for 6 years;
• return and fault records, which follow their normal rules: photos are deleted 2 years after our decision, and the record is anonymised after 6 years;
• messages you've sent us, which are deleted 2 years after you send them.

If you buy for a business account, we remove you from it, but the business account stays.

Closing your account doesn't remove copies of emails we've already sent you. These are held in our email records and by our email provider, and are deleted under their normal retention.

How to make a request

Email contact at frontline999 dot co dot uk, or ask us in any other way. It's free. We may need to confirm your identity first, usually by sending a confirmation request to the email address on your account or order. We'll respond within one month of receiving your request, or of confirming your identity if we need to. If a request is complex, we may extend that by up to two further months and will tell you why. If we hold a lot of information about you, we may ask you to tell us which information you're asking for, and the time limit pauses until you reply.

12. Children

Our sites are for adults and are not aimed at children. We don't knowingly collect personal data from anyone under 18. If you believe a child has given us their data, contact us and we'll delete it, unless we have to keep a record of a sale for tax purposes.

13. Complaints

If you're unhappy with how we've handled your personal data, please tell us at contact at frontline999 dot co dot uk. We aim to acknowledge your complaint within 10 working days, and will always do so within 30 days. We'll look into it without undue delay, keep you updated, and tell you the outcome.

You also have the right to complain to the UK regulator, the Information Commission, at any time. It replaced the Information Commissioner's Office on 30 September 2026 and is still known as the ICO. Website: ico.org.uk/make-a-complaint · Helpline: 0303 123 1113

14. Changes to this policy

We'll update this policy when our services or the law change, and show the date of the latest version at the top. If a change significantly affects how we use your data, we'll tell you by email or on the site before it takes effect.